CVE-2026-35348
MediumSummary
The sort utility in uutils coreutils crashes (panics) when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and uses expect(), causing an immediate crash upon encountering valid but non-UTF-8 paths.
Risk Assessment
The risk involves disruption of scripts or processes handling files that may contain names in various encodings (e.g., ISO-8859-2), potentially leading to data loss or service interruption.
Recommendation
It is recommended to update uutils coreutils to a version that removes the UTF-8 enforcement for the --files0-from option, or temporarily avoid using this option with files containing non-UTF-8 names.
Original NVD description (English source)
The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverge